I try not to have multiple actions write to the same file, you can have the
multiple actions call a single ruleset that then writes to the file
i.e.
local2.* call write
local5.* call write
local6.* call write
ruleset(name="write"){
?HOST_LOGS
}
David Lang
On Wed, 25 May 2022, Dimi Onobodies via rsyslog wrote:
Date: Wed, 25 May 2022 12:08:45 +0000
From: Dimi Onobodies via rsyslog <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Dimi Onobodies <dimi_...@hotmail.com>
Subject: [rsyslog] gz omfile template corrupts file when used with multiple
facilities
Hi
I hope I am not missing something obvious here.
I have a template which outputs logs to a gz file. I am using the template for
three facilities (local 2, 5 and 6].
When I log a message using one of the facilities, let's say local2, the gz
file is created as expected. However, if I use one of the other two facilities
(right after i used local2), say local5, it will corrupt the gz file.
This happens if each action is declared on a different line inside config.
However, if I add the actions inside the configuration file on a single line,
then it will not corrupt the file
In a nutshell:
The following template will corrupt log.gz file when using local2 AND either of
the other two facilities.
$OMFileZipLevel 6
$template HOST_LOGS,"/var/log/%HOSTNAME%.log.gz"
local2.* -?HOST_LOGS
local5.* -?HOST_LOGS
local6.* -?HOST_LOGS
# logger -p local2.info local2
# zcat /var/log/test-srv.example.com.log.gz
2022-05-25T03:28:00.117395-07:00 test-srv.example.com lab: local2
# logger -p local2.info local2-2
# zcat /var/log/test-srv.example.com.log.gz
2022-05-25T03:28:00.117395-07:00 test-srv.example.com lab: local2
2022-05-25T03:29:20.113595-07:00 test-srv.example.com lab: local2-2
# logger -p local5.info local5
# zcat /var/log/test-srv.example.com.log.gz
gzip: test-srv.example.com.log.gz: invalid compressed data--format violated
The following template will NOT corrupt log.gz
$OMFileZipLevel 6
$template HOST_LOGS,"/var/log/%HOSTNAME%.log.gz"
local2.*, local5.*, local6.* -?HOST_LOGS
# logger -p local2.info local2
# zcat /vat/log/test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
# logger -p local5.info local5
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 stest-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
# logger -p local6.info local6
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
2022-05-25T03:30:17.589634-07:00 test-srv.example.com lab: local6
# logger -p local2.info local2
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
2022-05-25T03:30:17.589634-07:00 test-srv.example.com lab: local6
2022-05-25T03:30:27.214990-07:00 test-srv.example.com lab: local2
Anyone has faced something similar before?
What could possibly cause this? Some sort of race condition opening the gz file
for writing ?
Thanks
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
